Privacy Policy

DRAFT for review. Product Owner (Sharon) review + an attorney pass are required before this is final. Not yet legal advice.

Upper Arlington Special Olympics is a small, volunteer-run club. We are based in Upper Arlington, Ohio. We are chartered under Special Olympics Ohio, a Program of Special Olympics International.

We care about the families and athletes we serve. This page explains what we collect on our website. It also explains why we collect it, who can see it, and how we keep it safe.

We use people-first language here. For example, we say "an athlete with an intellectual disability," not "a disabled athlete."

What we collect

We only collect what we need to run the club. Here is the list.

• Family contact info. Your name, email, phone, and mailing address.
• Athlete details. Each athlete's name, birth date, and uniform size.
• Sport assignments. Which sports each athlete plays.
• Photo and media consent. Your choice about photos and video of your athlete.
• Medical form date. The date a doctor signed your athlete's medical form. We do not collect or store the form itself. You keep the paper form. This comes later, not at first signup.

We do not sell your data. We do not share it for ads. We do not share it with anyone outside the club, unless the law makes us.

Why we collect it

We collect this info to run the club well and to keep athletes safe.

• Contact info lets us reach you about practices, events, and changes.
• Athlete details help us place each athlete and order the right uniform.
• Sport assignments help coaches plan and lead.
• The medical form date tells us an athlete has a current clearance to take part, and when it runs out.

Who can see your info

We limit who can see your info. Most club info is seen only by club admins and the family it belongs to.

Medical form dates and health-related fields are more sensitive. So we guard them more closely. Only these people can see them:

• Club admins. The volunteers who run the club.
• The owning family. You can see your own athlete's info.
• Coaches of the athlete's sport(s). A coach can see whether an athlete in their sport has a current medical form, and any health-related fields the club has added.

Coaches see this info read-only. That means they can view it but not change it.

We let coaches see health info on purpose. This is a safety choice. A coach may need to know about a health need during practice or a game. For example, a coach may need to know an athlete's seizure plan. Knowing this ahead of time helps the coach keep the athlete safe.

We keep a record of every change to an athlete's medical status. The record shows who confirmed a form, when they confirmed it, and any change to the date it runs out.

About the paper form. A doctor signs your athlete's medical form on paper. You keep that paper. You bring it to the club so an admin can see it in person. The club does not scan it, photograph it, or store it. [SHARON TO CONFIRM: how the club handles and stores paper forms offline, and any SO Ohio rule about keeping them]

How we keep your info safe

We use strong safeguards to protect your info. These include:

• Locked accounts, so only approved people can sign in.
• Access limits, so people see only what they need.
• A change log for every medical status, so we can see who confirmed what and when.
• Collecting as little as we can. We hold a date, not a health record.

About HIPAA

You may have heard of HIPAA. HIPAA is a federal health-privacy law. It applies to health plans and most health-care providers.

HIPAA does not legally apply to our club. We are not a health plan or a health-care provider. So we cannot and do not claim to be "HIPAA compliant."

Even so, we choose to protect medical info with strong, HIPAA-grade safeguards. In plain words: the law does not require this level of care from us, but we hold ourselves to it anyway.

Accounts and minors

A parent or caregiver always holds the family account. An adult athlete who is their own guardian may hold their own account.

Minors never get their own logins. A parent or caregiver always signs in for them.

How consent works

When you agree to something, we save it as a record. This is more than a checked box. The record stores:

• Who agreed. A parent, a caregiver, or an adult athlete who is their own guardian. A coach can never give this consent for a family.
• Which version of the text they agreed to.
• How we captured it. For example, online or by phone.

If we change the text later, we ask you to agree to the new version.

Photo and media consent

We sometimes take photos or video at practices and events. We may want to share them, such as on our website or social media.

You choose whether we may use your athlete's photo or video. You can say yes or no. You can change your choice at any time. Just contact us.

How long we keep your info

We keep your info only as long as we need it.

For medical forms, we keep only dates — the day a doctor signed the form and the day it runs out. We never hold the form itself. We keep the current date plus one older one for each athlete, so we can show your history. When you add a new date, the oldest one is retired.

When your family leaves the club, we remove your data within 30 days. Every deletion is logged.

Your rights

This is your info, and you have rights over it. You can:

• See the info we hold about your family.
• Update info that is wrong or out of date.
• Delete your family's info.

To use any of these rights, contact us at the address below. We will help you.

If there is a data breach

A data breach means someone sees or takes your info who should not. We work hard to prevent this. If it happens, we act fast.

Ohio law guides us here. We follow the Ohio breach-notice law, Ohio Revised Code § 1349.19. If a breach reaches families, we will tell you without needless delay, in the way and time the law requires.

Our change log helps us here. It shows which records were changed and by whom. So we can tell you what was affected.

Because we never store medical forms, a breach cannot expose one. The most sensitive things we hold are contact details, athlete birth dates, consent records, and any fields the club has added.

Changes to this policy

We may update this policy over time. If we make an important change, we will let families know. The date of the latest version will appear on this page when we publish it.

Contact us

Questions about your privacy? Please reach out.

• Club contact: [SHARON TO CONFIRM: club contact email]
• Legal entity and tax ID: [SHARON TO CONFIRM: exact 501(c)(3) entity name and EIN]